CVE-2025-45492 is a critical command injection flaw (CVSS 9.8) in the Netgear EX8000 range extender on firmware V1.0.0.126. The Iface parameter of the action_wireless function is not handled safely. No fixed version is listed, so check Netgear for new firmware and restrict access to the admin page.
What's affected
Per the CVE record, Netgear EX8000 firmware V1.0.0.126 is vulnerable to command injection through the Iface parameter in the action_wireless function. The affected products are the EX8000 and its firmware.
The record does not give a fixed firmware version. It references a PDF write up and a video in a public GitHub repository, neither of which I retrieved. Check Netgear's support page for the EX8000 and read the release notes for anything newer than V1.0.0.126.
The vector is network based with low complexity, no privileges and no user interaction, and the impact is high on confidentiality, integrity and availability. The record reports no attacks in the wild, and the KEV flag is false.
Because the EX8000 is a range extender, many people forget that it is a full network device with its own web interface, its own firmware and its own update cycle.
How to check if you're exposed
Open the EX8000 admin page, or the Netgear app, and read the firmware version. If it is V1.0.0.126, it is in scope.
Then check who can reach the admin page. Any device on the same wireless network can usually see it, which includes guests and smart devices if you do not separate them. From a machine on the network, test the extender:
nmap -p 80,443 <extender-address>
Run this only against devices you own. Then confirm that nothing forwards a port from your router to the extender, and that no remote management option is on.
If you run these units across an office, a floor walk and a scan of your address space for the extender's web interface will give you a fast count.
What to do now
- Find all Netgear EX8000 units and record their firmware versions.
- Check Netgear's support page for firmware newer than V1.0.0.126, and install it when it exists.
- Keep guests and untrusted devices on a separate network from the extender's admin page.
- Turn off remote management and any port forwards to the extender.
- Change the admin password to a long unique one.
- If the device is unsupported or unpatched and the network matters, replace it, or remove it if you no longer need the range.
- Add range extenders to your device inventory.
Why it matters
The record maps the issue to CWE-77, command injection. The Iface value names a wireless interface, and the firmware appears to pass it on to a system command without enough checking. A name that should be one of a few safe values becomes a way to run other commands.
Extenders are easy to overlook. They sit in a corner, are forgotten at update time, and share a network with everything else. A compromised one sees the traffic of devices that connect through it.
Treat network gear with the same discipline as servers. Keep a list, check for firmware updates on a schedule, and keep admin pages off untrusted networks.
For the software you write or ship, Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan is a quick check, and the Gold directory lets you look up CVEs by vendor.
Quick check
Is CVE-2025-45492 being exploited in the wild?
The record does not report exploitation and its CISA KEV flag is false. That can change, so check the CISA catalog again before you decide how urgent this is.
What does Iface refer to?
Per the record, it is a parameter of the action_wireless function. It most likely names a wireless interface, but the record does not say. Read the public write up for detail.
Sources
- CVE-2025-45492 on Gold
- NVD record for CVE-2025-45492
- References listed in the CVE record: a PDF write up and a video in a public GitHub repository. They were not retrieved when this post was written.
Last reviewed: 18 October 2026.
